RISK MANAGEMENT AND PROCEDURES MANUAL FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING JUST2TRADE ONLINE LTD 31 ST DECEMBER 2017

Transcription

1 RISK MANAGEMENT AND PROCEDURES MANUAL FOR THE PREVENTION OF MONEY LAUNDERING AND TERRORIST FINANCING JUST2TRADE ONLINE LTD 31 ST DECEMBER 2017

2 CONTENTS 1. Introduction Definition of Money Laundering Stages for Money Laundering Definition of Terrorism Financing Money Laundering Offences (Article 4 of the Law) Predicate offences (Article 5 of the Law) Responsibilities Internal Control Systems Board of Directors: duties and responsibilities Anti Money Laundering Compliance Officer Customer Identification and due Diligence Procedures Know your Client Principle (KYC) Clients Acceptance Procedures Rejection of clients Due Diligence and identification data updating of existing Clients Client Categorization Client Due Diligence (CDD) Simplified Client Due Diligence and Identification Procedures Transaction Monitoring Program Reliance on Third Parties for Client Identification Cash Transactions Money transfers to third parties Risk Based Approach List of Potential Risks Risk variables in relation to Business Risks Regulatory risks category Policies, Procedures and Controls for Risk Containment Record Keeping General Format of Records Certification and Language of documents Audit Trail Updating of Clients Identification Records Recognition and Reporting Suspicious Transactions Recognition... 30

3 7.2 Employee s Obligations How to Identify a Suspicious Transaction Reporting of Suspicious Transactions Internally and to the Authorities Education and Training of Staff ACRONYMS APPENDIX 1: Internal Suspicion Report for Money Laundering and Terrorist Financing APPENDIX 2: Internal Evaluation Report for Money Laundering and Terrorist Financing APPENDIX 3: Examples of Suspicious Transactions/Activities Related to Money Laundering and Terrorist Financing APPENDIX 4: Client s Acceptance Policy Introduction Client Categorisation Accepting New Clients Documentation for Individuals Documentation for Legal Entities Documentation for politically exposed persons (PEPs) Type of Documentation Risk Mitigation procedures... 57

4 1. Introduction The Prevention and Suppression of Money Laundering Activities Law of 2007, Ν.188(I)/2007, as amended (the Law ) recognizes the important role of the financial sector for the forestalling and effective prevention of money laundering and terrorist financing activities and places additional administrative requirements on all financial institutions. The Law requires all persons carrying on financial and other business to establish and maintain specific policies and procedures to guard against their business and the financial system in general being used for the purposes of money laundering. These procedures are designed to achieve two main purposes: a) To facilitate the recognition and reporting of suspicious transactions b) To ensure through the strict implementation of the "know-your-customer" principle and the maintenance of adequate record keeping procedures, should a customer come under investigation, that the financial institution is able to provide its part of the audit trail. The Risk Management and Procedures Manual for the Prevention of Money Laundering and Terrorist Financing (hereafter refers as the Manual ) provides the guidelines that should be followed throughout the Company to assist in the detection and/or prevention of money-laundering and terrorist financing activities in accordance with the Law and the relevant Directive of the Cyprus Securities and Exchange Commission ( CySEC ), or any other Directive or Circular amending, substituting or supplementing the said Directive The aim of this Manual is to provide the guidelines that should be followed throughout Just2Trade Online Ltd (hereafter refers as the Firm or the Company ) for the detection and/or prevention of money-laundering activities and terrorist financing. All Company s staff shall perform their duties as per the guidelines set out in this Manual and the relevant Company Operations Manuals. 1.1 Definition of Money Laundering

5 Money laundering is defined broadly, and includes all forms of handling or possessing criminal property, including possessing the proceeds of one s own crime, and facilitating any handling or possession of criminal property. Criminal property may take any form, including money, securities, tangible property and intangible property. Money laundering can be committed in respect of the proceeds of offences that are considered as predicate offences in the Republic of Cyprus (hereafter refers as the Republic ), irrespective of whether the predicate offence was committed in the Republic or another Country. Illegal profits can be generated for example through drug trafficking, illegal arms sales, smuggling, insider trading, embezzlement, corruption & bribery, prostitution, and internet fraud schemes and any other criminal offence punishable in the Republic by a term imprisonment exceeding one year. Businesses and individuals need to be alert of the risk of clients, their counterparties and others laundering money in any of its possible forms. The business or its client does not have to be a party to money laundering for a reporting obligation to arise. Money laundering is not only about cash transactions. Money laundering can be achieved through virtually every medium and financial institution or business. For the purpose of this Manual, money laundering is also taken to encompass activities related to terrorist financing, including handling or possessing funds to be used for terrorist purposes as well as proceeds from terrorism. 1.2 Stages for Money Laundering There is no single method of laundering money. Despite the variety of methods employed, the laundering process is accomplished in three basic stages which may comprise transactions by the launderers that could alert a financial institution to criminal activity: Placement The process of placing, through deposits or other means, unlawful cash proceeds into traditional financial institutions. Layering The process of separating the proceeds of criminal activity from their origin through the use of layers of complex financial transactions, such as converting cash into traveler s cheques, money orders, wire transfers, letters of credit, stocks, bonds, or purchasing valuable

6 assets, such as art or jewelry. All these transactions are designed to disguise the audit trail and provide anonymity. Integration The process of using an apparently legitimate transaction to disguise the illicit proceeds, allowing the laundered funds to be disbursed back to the criminal. Different types of financial transactions, such as sham loans or false import/export invoices, can be used. If the layering process is successful, integration schemes place the laundered proceeds back into the economy in such a way that they re-enter the financial system appearing as normal business funds. The three basic steps may occur as separate and distinct phases or may occur simultaneously or, more commonly, they may overlap. How the basic steps are used depends on the available laundering mechanisms and requirements of the criminal organizations. 1.3 Definition of Terrorism Financing Terrorism is defined as the use or threat of action designed to influence government, or to intimidate any section of the public, or to advance a political, religious or ideological cause where the action would involve violence, threats to health and safety, damage to property or disruption of electronic systems. Terrorism financing is an offence by any means, directly or indirectly, unlawfully and willfully, which provides or collects funds with the intention that they should be used or in the knowledge that they are to be used, in whole or in part, in order to carry out an act intended to cause death or serious bodily injury to a civilian, or to any other person not taking an active part in the hostilities in a situation of armed conflict, when the purpose of such act, by its nature or context, is to intimidate a population, or to compel a government or an international organization to do or to abstain from doing any act. 1.4 Money Laundering Offences (Article 4 of the Law) Every person who knows or ought to have known that any kind of property constitutes proceeds from a predicate offence is guilty of an offence if he/she carries out any of the following:

7 Converts or transfers or removes such property for the purpose of concealing its illicit origin or of assisting any person who is involved in the commission of a predicate offence to evade the legal consequences of his actions Conceals or disguises the true nature, the source, location, disposition, movement, rights with respect to property or ownership of this property; Acquires, possesses or uses such property Participates in, associates or conspires to commit or attempts to commit and aids and abets and provides counseling or advice for the commission of any of the above mentioned offences Provides information with respect to investigations that are being performed for laundering offences for the purpose of enabling the person who acquired a benefit from the commission of a predicate offence to retain the relevant proceeds 1.5 Predicate offences (Article 5 of the Law) Predicate offences are all criminal offences punishable with imprisonment exceeding one year from which proceeds were generated that may become the subject of a money laundering offence. Proceeds mean any kind of property which has been generated by the commission of a predicate offence. Among others are the following: a) drug trafficking b) fraud c) theft d) premeditated and attempted murder e) illicit importation, exportation, purchasing, selling disposition, possession, transfer and trafficking of arms and munitions f) importation, exportation, purchasing, selling, disposition, possession, transfer of stolen objects, pieces of art, of antiquities and tokens of cultural heritage g) detachment of money or of property of any kind by use or threat of use of force or other illicit act h) living on the earnings of prostitution and offences associated with procuration and seduction of women and minors i) offences relating to corruption of public or private servants For the purposes of money laundering offences it does not matter whether the predicate offence is subject to the jurisdiction of the Cyprus Courts or not.

8 The Law applies to the offences referred to as laundering offences and predicate offences. Conviction of any of the above offences is punishable by up to 14 years imprisonment and/or a fine up to Responsibilities This Manual will be subject to an ongoing review and update by the Compliance Department so as to ensure full compliance with current legislation, regulations and the CySEC Directives. This Manual and related policies, rules, operations and controls bind the members of the Board of Directors (hereafter refers as BoD ), the Executives, Heads and Managers of the Company Divisions, the staff members, and any other person involved in the operations of the services offered. The primary responsibility lies with the Board of Directors which delegates operational responsibility to the Executives, Heads, and Managers of the Divisions. The procedures and recommendation contained in this Manual must be followed strictly by the Company s personnel. Staff should be made aware of the seriousness of Money Laundering and Terrorist Financing activities, their own statutory obligations and be encouraged to co-operate and report suspicious transactions promptly. This can be done through the completion of the Internal Suspicion Report for Money Laundering and Terrorist Financing, which can be found in Appendix 1, and should be submitted, to the Anti Money Laundering Compliance Officer ( AMLCO ). It is the responsibility of all Company employees to read and understand the Company s Anti-Money Laundering and Terrorist Financing Manual. Each employee receives a copy of the Manual and has to sign that he/she has read and understood its contents and understands the responsibilities and procedures outlined in it. All Company employees must follow any corrective measures the AMLCO may suggest during on-site visits or other forms of evaluation of procedures and controls to prevent money laundering and terrorist financing. It is the duty and responsibility of the Head/Officer of the relevant Division to exercise the duties within his/her area of responsibility as itemized in this Manual, and be in line with the Policies of the Company, the Law, and any directives relevant to his/her area of responsibility.

9 The AMLCO ensures that the employees and divisions operate within the scope of the policies and rules outlined in this Manual. 1.7 Internal Control Systems Internal Control Systems should be established so as to monitor compliance with the procedures introduced by the Company for the prevention and detection of Money Laundering. The compliance function is responsible to confirm adherence to various Anti-Money Laundering procedures through specifically designed audits and/or other functional audits. The internal auditor reviews and assesses, at least on an annual basis, the appropriateness, effectiveness and adequacy of the policy, practices, measures, procedures and control mechanisms applied for the prevention of money laundering and terrorist financing. The findings and observations of the internal auditor are submitted, by a way of a written report, to the BoD which decides the necessary measures that need to be taken to ensure the rectification of any weaknesses and/or deficiencies which have been detected. The minutes of the abovementioned decision of the BoD and the internal auditor s report are submitted to the CySEC within twenty days from the date of the relevant meeting. 2. Board of Directors: duties and responsibilities The Company s Board of Directors shall have the duty to: a) determine records and approve the general policy principles of the Firm in relation to the prevention of Money Laundering and Terrorist Financing and communicates them to the AMLCO. b) appoint a AMLCO and, where necessary, assistant compliance officers and determines their duties and responsibilities, which are recorded in this manual. The AMLCO is part of the management of the Company so as to command the necessary authority. c) approve the Anti-Money Laundering and Prevention of Terrorist Financing Manual, which is communicated to all the Firm s employees that manage, monitor or control in any way the clients transactions and have the responsibility for the application of the practices, measures, procedures and controls that have been determined.

10 d) ensure that all requirements of the Law and the Directive are applied, and to assure that appropriate, effective and sufficient systems and controls are in place. e) assure that the AMLCO and his assistants and any other person who has been assigned the duty of implementing the procedures for the prevention of money laundering and terrorist financing, have complete and timely access to all data and information concerning client identity, transactions documents and other relevant files and information maintained by the Firm so as to be fully facilitated in the effective execution of their duties. f) ensure that the compliance officer has sufficient resources, including competent staff and systems, for the effective discharge of its duties. g) ensure that all employees are aware of the person who has been assigned the duties of the AMLCO, as well as his assistants, and to whom they report, any information concerning transactions and activities of which they have knowledge or suspicion might be related to money laundering and/or terrorist financing. h) establish a clear and quick reporting chain through which information regarding suspicious transactions is passed without delay to the AMLCO. i) assess and approve the Annual Anti-Money Laundering and Terrorist Financing Report and to take all action deemed appropriate under the circumstances to remedy any weaknesses and/or deficiencies identified in the Report.

11 3. Anti Money Laundering Compliance Officer The AMLCO is generally responsible to ensure that the operations and activities of the Company are in compliance with the Law, the Directive, and the general legal and regulatory framework that relate to ML & TF; and to review, appraise and report and monitor relevant action on compliance issues as required. The AMLCO reports primarily to the Executive Director and directly to the BoD. The AMLCO duties should include at least, the following: a) Based on the general policy principles set by the BoD of the Firm, the AMLCO designs the internal practices, measures, procedures and controls relevant to the prevention of money laundering and terrorist financing, and describes and explicitly allocates the appropriateness and the limits of responsibility of each department that is involved in the abovementioned. b) Develops and establishes the clients acceptance policy and submits it to the BoD for consideration and approval. c) Prepares a risk management and procedures manual regarding anti-money laundering and terrorist financing. d) Monitors and assesses the correct and effective implementation of the policy, and the implementation of the AML Manual. Applies appropriate monitoring mechanisms and, in the event that he identifies shortcomings and/or weaknesses in the application of the set practices, measures, procedures and controls, gives appropriate guidance for corrective measures and where he deems necessary informs the BoD. e) Receives information from the Company s employees which is considered to be knowledge or suspicion of money laundering or terrorist financing activities or might be related with such activities. The information is received in a written report form (see Appendix1). f) Examines and evaluates the information received as per paragraph (e), by reference to other relevant information and discusses the circumstances of the case with the informer and, where appropriate, with the informer s superiors. The evaluation of the information reported should be recorded and retained on file, (see Appendix 2). g) If following the evaluation described in paragraph (f), the AMLCO decides to notify MOKAS, he completes a report and submits online to MOKAS via goaml Professional Edition (PE) IT system the soonest possible. After the submission of the AMLCO s report to MOKAS, the accounts involved and any other connected accounts, are closely monitored by the AMLCO and following any directions from MOKAS, thoroughly investigates and examines all the transactions of the accounts.

12 h) If following the evaluation described in paragraph (f) the AMLCO decides not to notify MOKAS, then he fully explains the reasons for such a decision in the "Internal Evaluation Report". i) Acts as the first point of contact with MOKAS, upon commencement and during an investigation as a result of filing a report to MOKAS. j) Responds to all requests and queries from MOKAS and the CySEC, provides all requested information and fully cooperates with MOKAS and the CySEC. k) Ensures the preparation and maintenance of the lists of clients recording money laundering risk profiles. l) Detects, records, and evaluates, at least on an annual basis, all risks arising from existing and new clients, new financial instruments and services and updates and amends the systems and procedures applied by the Company for the effective management of the aforesaid risks. m) Evaluates the systems and procedures applied by a third person on whom the Firm relies for client identification and due diligence purposes, and approves the cooperation with it. n) Ensures that any branches and subsidiaries of the Company that may operate in countries outside the European Economic Area, have taken all necessary measures for achieving full compliance with the provisions of the present Directive, in relation to client identification, due diligence and record keeping procedures. o) Provides advice and guidance to the employees of the Company on subjects related to money laundering and terrorist financing. p) Acquires the required knowledge and skills for the improvement of the appropriate procedures for recognising, preventing and obstructing any transactions and activities that are suspected to be associated with money laundering or terrorist financing. q) Determines the Company s departments and employees that need further training and education for the purpose of preventing money laundering and terrorist financing and organises appropriate training sessions/seminars. Assesses the adequacy of the education and training provided. r) Prepares and submits in a timely manner to the CySEC the monthly prevention statement and provides the necessary explanation to the appropriate employees of the Company for its completion. s) Prepares the Annual Report according to the provisions of paragraph 10 of the Directive and submits it to the BoD for approval, within two months from the end of each calendar year (the latest by the end of February).

13 t) Maintains a registry which includes the reports of points (e), (f) and (g), and relevant statistical information (department that submitted the internal report, date of submission to the AMLCO, date of assessment, date of reporting to MOKAS), the evaluation reports of point (d) and all the documents that verify the fulfilment of his duties specified in the present subparagraph. u) During the execution of his duties the AMLCO obtains and utilizes data, information and reports issued by relevant international organizations. 4. Customer Identification and due Diligence Procedures The Law requires that the Company maintains certain identification procedures to verify its customers identity. The identity of a prospective customer should be established at the time of establishing an account relationship and prior to the execution of any transaction or the provision of any services whatsoever. The execution of any transaction or the provision of any services prior to establishing the identity of the customer is strictly prohibited. Every reasonable effort should be made to determine the true identity of any person who asks to open an account, enters into a business relationship with the Company, or undertakes a significant one-off transaction or a series of linked transactions. 4.1 Know your Client Principle (KYC) Know Your Client processes are intended to enable a company to form a reasonable belief that it knows the true identity of each customer before the client enters into a business relationship with the Company. The need to effectively KYC is at the very heart of an efficient anti-money laundering management system. KYC due diligence is a continuous process and not only limited to clients seeking to open new accounts. While client identification procedures are aimed at establishing clients identity, the Company is also required to decide whether the clients risk-profile necessitates enhanced due diligence procedures. The resources used to undertake effective customer due diligence are not prescribed. Various sources may be used to enhance a business knowledge of its client, including direct discussion with the client, information (e.g. websites, brochures, reports etc) prepared by the client and review of public domain information.

14 4.2 Clients Acceptance Procedures The Company s Client s Acceptance Policy is attached in the form of Appendix 4 of this Manual. Generally, prior to the establishment of a business relationship the following procedures must be performed: (1) Every potential client of the Firm has to complete the account opening forms and return them along with the supporting documents required. (2) Whenever possible, the prospective client should be interviewed personally. The verification procedure necessary to establish the identity of the prospective client is basically the same irrespective of the type of account or service required. (3) Identify the client and verify the client s identity on the basis of data, documents or information obtained from reliable and independent sources. (4) In case the client - legal entity identify the beneficial owner and take adequate measures to verify his identity based on records, documents or information obtained from independent and reliable sources. (5) Identify the clients Economic Profile. Back Office personnel requests through a client questionnaire and obtains sufficient data and information regarding the client s business activities the volume of transactions, purpose of opening the account, expected origin of funds and destination e.g. countries and names of principal counterparties, the client s source and size of wealth and annual income. (6) Identify the clients Risk Profile. Clients should be designated as high, low or normal risk. For the identification criteria refer to Paragraph Rejection of clients The Client Acceptance Policy shall clarify the categories of prospective clients with whom the Firm shall not proceed with the establishment of any business relationship or execution of any occasional transaction. The said policy should be revised on annual basis. Furthermore it shall specify the circumstances/situations where a business relationship with a client may be terminated. 4.4 Due Diligence and identification data updating of existing Clients

15 The client identification data and records should be reviewed on a regular basis or whenever there are doubts for their accuracy. In addition to the above cases, the Client s identity and business/economic profile should be checked in case any of the following occurs: i. An individual transaction takes place which is incompatible with the normal pattern of transactions of the customer or the customer s business or economic profile ii. There is a material change in the customer s legal status such as: Change of director(s)/secretary Change of registered shareholders/beneficial owners Change of registered office Change of trustee Change of corporate name/trading name used Change of principal trading partners and/or assumption of new major business activities iii. There is material change in the way the account operates: Change in the person(s) that are authorised to operate the account(s) and Application for the opening of new account(s) or the provision of new services and/or products If a Client fails or refuses to submit, within a reasonable timeframe, the required data and identification information for the updating of his/her identity and business/economic profile and, as a consequence, the Firm is unable to comply with the customer identification requirements set out in the Law and the Directive, then the Company will consider the possibility to terminate the business relationship and inactivate or close all accounts of the customer concerned, while at the same time it should examine whether it is warranted under the circumstances to submit a report of suspicious transactions/activities to MOKAS. 4.5 Client Categorization The Company should assess whether the particular Client poses a risk of money laundering and on basis of such assessment a Clients should be categorized as high, low or normal risk. The category of each client should be maintained in the Company s records, and which must also contain the following information: clients name, account number, and date of commencement of business relationship.

16 4.6 Client Due Diligence (CDD) The purpose of the CDD is to confirm the identity of the client. For the client s identity to be confirmed, independent and reliable information is required. The Law requires the records obtained during the CDD to be maintained for five years after a client relationship has ended. The Client Due Diligence (CDD) must be applied: When establishing a business relationship When suspecting money laundering or terrorist financing where there are doubts about the reliability or adequacy of documents or information previously obtained for identification. At appropriate times to existing clients on a risk sensitive basis. When a client requires a different service and there is suspicion for money laundering. 4.7 Simplified Client Due Diligence and Identification Procedures The Simplified Client Due Diligence can be applied to the Persons that fulfill the criteria of the Low Risk Clients. 4.8 Transaction Monitoring Program The purpose of a transaction monitoring program is to identify transaction activity that appears to be suspicious. The transaction monitoring process is conducted by the responsible person on a regular basis and consists of the following steps: monitoring client transactions in accordance with the Company s policies, systems and procedures identifying suspicious transactions - (Appendix 3) taking appropriate action. 4.9 Reliance on Third Parties for Client Identification

17 The Company may rely on third parties to apply any or all of the CDD procedures relating to verification of identity of the client or beneficial owner and the nature and purpose of the intended business relationship, provided that such a third party is a respected and regulated professional (e.g. an independent lawyer, an auditor or the director or manager of a regulated financial institution). However, the Law explicitly provides that the ultimate responsibilities for performing these measures and procedures, remains with the Company. The Law defines as third person a credit or financial institution or auditors or independent legal professional or trust and company service providers situated: a. in the European Economic Area or b. in a country outside the European Economic Area which, in accordance with a decision of the Advisory Authority for Combating Money Laundering and Terrorist Financing it has been determined that it applies procedures and measures for the prevention of money laundering and terrorist financing equivalent to those laid down in the European Union Directive. And who: Are subject to mandatory professional registration recognised by law, and Are subject to supervision with regard to their compliance with the requirements of the European Union Directive It is noted that the Company may rely on third parties only at the outset of establishing a business relationship for the purpose of ascertaining and verifying the identity of their customers. Any additional data and information for the purpose of examining unusual transactions executed through the account, should be obtained from the natural persons (directors, beneficial owners) who control and manage the activities of the customer and have the ultimate responsibility of decision making as regards management of fund and assets. Moreover, the Company should obtain data and information so as to verify that the third person is subject to professional registration in accordance with the competent law of its country of incorporation and/or operation as well as supervision for the purposes of compliance with the measures for the prevention of money laundering and terrorist financing. In the case where the third person is an accountant or an independent legal professional or a trust and company service provider either from a country which is a member of the European Economic Area or

18 a third country as defined above, then the Company is obliged, before accepting the customer identification data verified by the said person, to apply the following measures/procedures: The Compliance Officer evaluates the systems and procedures applied by the third person for the prevention of money laundering and terrorist financing. If the Compliance Officer is satisfied, he/she gives his/her approval for the commencement of cooperation with the third person and the acceptance of identification data verified by the third person at the establishment of the business relationship with customers Cash Transactions Generally Clients will have to deposit their funds directly into the Firm s client accounts via regulated financial institutions or other regulated types of payment institutions. The Company does not accept cash from clients Money transfers to third parties Generally, money transfers to third parties are prohibited. Despite this it is recognised that there may be certain cases where this may be necessary or appropriate. For example in the case of death, any money/assets in a client s account should be able to be transferred to an heir. In such cases a full account review is triggered and the Accounting and Finance Department is not allowed to authorise third party transfers unless the following three conditions are all fulfilled: a. there is a written request for a transfer between accounts signed by both the transferor and the transferee; b. the BACK OFFICE verifies the signature and confirms the client s request, unless the request is signed in the presence of Firm staff, and such signature is so witnessed; and c. the transaction is approved by the Executive Director 2 after considering and examining all relevant information and circumstances. 5. Risk Based Approach The Company s Risk Based Approach is designed to target resources and efforts where the risk is greatest and, conversely, reduce requirements where the risk for ML & FT is low.

19 The AMLCO shall establish adequate and appropriate policies and procedures relating to risk assessment and management in order to prevent operations related to money laundering or terrorist financing. The Risk Based Approach policy shall be revised at least on annual basis. The Company shall: Determine the extent of customer due diligence measures on a risk-sensitive basis depending on the type of client, business relationship, or services to be provided; Be able to demonstrate to supervisory authorities that the extent of customer due diligence measures is appropriate in view of the risks of money laundering and terrorist financing. Take adequate measures to verify the identity of beneficial owners so that they are satisfied that they know who the beneficial owner is and what the control structure is in respect of a client who is other than a natural person. Scrutinize clients transactions throughout the course of the business relationship to ensure consistency with businesses and individuals knowledge of the client, the client s business and risk profile. Keep up-to-date the information collected in applying customer due diligence measures. Apply customer due diligence measures at appropriate times to existing clients on a risk-sensitive basis. The Company appreciates that the continuing threat of money laundering and terrorist financing through the financial system is most effectively managed by understanding and addressing the potential money laundering and terrorist financing risks associated with clients and transactions. It is well understood that money launderers go to great lengths to make their transactions indistinguishable from legitimate transactions. Consequently, it is exceedingly difficult for an institution to distinguish between legal and illegal transactions, notwithstanding the development and implementation of a reasonably designed risk based approach in the Company's AML program. Further, funds that may be used to finance terrorist activities do not necessarily derive from criminal activity and, an RBA of clients and transactions will not always achieve the desired aim of identifying potential terrorist funds. However, to the extent that some or part of terrorist financing originates from money laundering, an effective RBA would benefit the fight against terrorist financing by providing the means to identify and report money laundering to supervising authorities.

20 An assessment of money laundering risks will result in the application of appropriate due diligence when entering into a relationship, and ongoing due diligence and monitoring of transactions throughout the course of the client relationship. A reasonably designed RBA provides a framework for identifying the degree of potential money laundering risks associated with clients and transactions and allow for the Company to focus on those clients and transactions that potentially pose the greatest risk of money laundering. There is no universally agreed and accepted methodology by either governments or institutions, which prescribes the nature and extent of a RBA. The central characteristics of the RBA to be employed by the Firm are the following: a. Identification of the Categories of Risks the Company expects to confront in relation to Money Laundering and Terrorist Financing b. Identification, Recording and Evaluation of the Potential Risks c. Measures and Controls for Risks containment d. Education and Training The above characteristics are further elaborated below. It is noted that the RBA should be periodically assessed and reviewed. a. Identification of the Categories of Risks The types of risks that the Firm expects to confront in relation to Money Laundering and Terrorist Financing ( ML and TF ) fall into two broad categories: Business Risks, and Regulatory Risks. Business Risks refers to the risks that designated services may be used for purposes of ML & TF and is associated with circumstances or factors that may have a negative impact on the operations, reputation or profitability of the Company. In relation to this category, the Firm will assess the following particular risks: Client Risks Products or Services Risks Business Practices and/or Delivery Method Risks Country or Jurisdictional Risks.

21 The weight to be given to the above particular risks (individually or in combination) in assessing the overall risk of potential money laundering is examined on a case by case basis for individual clients, aiming to the effective management of potential money laundering risks associated especially with potentially high risk clients. Regulatory Risks refers to the risks associated with not meeting the obligations under the Law. Examples of regulatory obligations that may be breached include failure to verify the identity of clients and failure to report suspicious matters. b. Identification, Recording and Evaluation of the Potential Risks The AMLCO has the responsibility to identify, record and evaluate all potential risks. The measures and procedures that have been decided to this end across the Company will be clearly communicated throughout the Company in order to ensure that these are implemented effectively. The measures and procedures for the identification, recording and evaluation of particular risks are the following: The AMLCO is fully conversant with the products and services and operations of the Company, as well as the types of clients of the Company. The AMLCO makes a comprehensive list of potential risks that, according to international practice and warnings, is associated with the provision of the particular services and the types of clients of the Company (e.g. clients-trusts or non face-to-face). The list is communicated throughout the Company, as well as the List of Suspicious Transactions/Activities Related to Money Laundering and Terrorist Financing (Appendix 3 to this Manual). The potential Risks List is adjusted and updated based on any Company-specific information the AMLCO must receive from the employees at the onset of any suspicious transactions. The Risks List is also periodically assessed and reviewed, based on the development of products and services of the Company in new products or types of clients, as well as the development of new methods and technologies that may facilitate anonymity and/or ML and TF. The Risks List and the Suspicious Transactions List, become an integral part of the regular Education and Training of the Company management and personnel. The AMLCO is responsible, based on the information he receives from the trained personnel as above, as well as from his monitoring and assessment of the effective implementation of the Company s AML & TF policies, to record and evaluate the actual and potential risks the Company faces. The AMLCO maintains a log book stating any suspicions notified and

22 examined, any particular risks or weaknesses identified and the measures undertaken for their effective containment. Where any weaknesses are identified the AMLCO will propose appropriate improvements for their effective resolution. 5.1 List of Potential Risks 1. Clients acceptance risk Clients Behaviour risks Determining the potential money laundering risks posed by a client will provide significant input into the overall money laundering risk assessment. The Company will assess, whether a particular client poses a higher risk of money laundering and whether mitigating factors may lead to a determination that clients engaged in such activities do not pose a higher risk of money laundering. Application of the risk variables described further below plays an important part in this determination. There is no universal consensus as to which clients pose a higher risk, but the below listed characteristics of clients have been identified with potentially higher money laundering risks: Non face-to-face clients Accounts in the names of companies whose shares are in bearer form Trusts accounts Client accounts in the name of a third person Politically exposed persons accounts Electronic gambling /gaming through the internet Clients from countries which inadequately apply Financial Action Task Force s ( FATF ) recommendations Accounts with complexity of ownership structure of legal persons Companies incorporated in offshore centres, Clients from high risk countries or from countries known for high level of corruption or organized crime or drug trafficking New clients who want to carry out a large transaction Clients or groups of clients making lots of transactions to the same individuals or groups Clients who have businesses which involve large amounts of cash Clients whose identification is difficult to check Clients who bring in large amounts of used notes and/or small denominations.

23 Armament manufacturers, dealers and intermediaries. Cash (and cash equivalent) intensive businesses including: money services businesses (remittance houses, exchange houses, casas de cambio, bureaux de change, money transfer agents and bank note traders) Casinos, betting and other gambling related activities, or businesses that while not normally cash intensive, generate substantial amounts of cash for certain transactions. Unregulated charities and other unregulated non-profit organisations (especially those operating on a cross-border basis). Dealers in high value or precious goods (e.g jewels, gems and precious metals dealers, art and antique dealers and auction houses, estate agents and real estate brokers). Accounts for "gatekeepers" such as accountants, lawyers, or other professionals for their clients where the identity of the underlying client is not disclosed to the financial institution. Accounts for clients introduced by such gatekeepers may also be higher risk where the financial institution places unreasonable reliance for KYC and AML matters on the gatekeeper. Clients who wish to make large cash deposits or withdrawals. The following factors should also be considered in association with the clients characteristics and behaviour: Client transactions where there is no apparent legal financial/commercial rationale; Situations where the origin of wealth and/or source of funds cannot be easily verified; Unwillingness of clients to provide information on the beneficial owners of a legal person; Transactions that are unnecessarily complex for their stated purpose; Transfers being made on behalf of a third party; Transactions that are inconsistent with financial standing or occupation, or are outside the normal course of business for the client in light of the information provided by the client when conducting the transactions or during subsequent contact (such as an interview) with the client(s); Cases where the type and behaviour of client falls outside the norm, i.e. the common characteristics and behaviour patterns of the majority of the Company s clients; Clients willing to pay unusual fees to have transactions conducted. 2. Products and services risks

24 Due care should be paid for new or innovative products or services not specifically being offered by the Firm, but that make use of the Company s services to deliver the product. Determining the money laundering risks of services should include a consideration of such factors as: Products or services that may inherently favour a degree of anonymity or can readily cross international borders, such as online money transfers, stored value cards, money orders and money transfers by mobile phone. Services identified by regulators, governmental authorities or other credible sources as being potentially high risk for money laundering including, for example: o International Correspondent Banking services, and o International Private Banking services. Services involving banknote and precious metal trading and delivery. 3. Business practice/delivery method (channels) risks It is generally acknowledged that non face-to-face clients, present higher risk for engaging to ML and TF, and, in the evaluation of clients risk propensity, the method and medium used for the opening of the account, communications and business practice/delivery methods, are assessed and given due weight. How did the client communicate with the Firm? online/internet phone fax third-party agent or broker. Is the client familiar with the Firm s employees, or is he/she a: non face to face client, or/and client introduced by a third person? In relation to non face-to-face clients the Firm applies enhanced customer identification and due diligence measures, so as to effectively mitigate the risks associated with such business relationships or occasional transactions.

25 4. Country/jurisdiction risks Country/area risk, in conjunction with other risk factors, provides useful information as to potential ML & TF risks. There is no universally agreed definition by either governments or institutions that prescribes whether a particular country represents a higher risk. Factors that may result in a determination that a country poses a higher risk include: Any country subject to trade sanctions embargoes or similar measures issued by, for example, the United Nations ( UN ). Any country known to be a tax haven, source of narcotics or other significant criminal activity. Countries identified by FATF Statements or credible sources as having a weak anti money laundering / counter terrorist financing regime, and for which financial institutions should give special attention to business relationships and transactions. Countries identified by the FATF as non-cooperative in the fight against money laundering or identified by credible sources as lacking appropriate money laundering laws and regulations. Countries identified by credible sources as providing funding or support for terrorist activities. Countries/areas identified by credible sources as having significant levels of corruption, or other criminal activity, including source or transit countries/areas for ongoing criminal activity, such as illegal drugs, human trafficking and smuggling, systematic frauds and illegal gambling. 5.2 Risk variables in relation to Business Risks The Company s RBA will also take into account additional risk variables, specific to any particular client or transaction. These variables may increase or decrease the perceived risk posed by a particular client or transaction and may include: The level of assets to be deposited by the particular client or size of transactions undertaken. For example, unusually high levels of assets or unusually large transactions compared to what might reasonably be expected of clients with a similar profile may mean that clients not otherwise seen as higher risk should be treated as such. Conversely, low levels of assets or low value transactions involving clients that would otherwise appear to be higher risk mean that the Company may decide to treat such clients as lower risk within an overall RBA.

26 The level of regulation or other oversight or governance regime to which a client is subject to. A client that is a financial institution, for example, regulated in a jurisdiction recognised as having adequate AML standards (or is part of a group that implements a group standard where the parent is subject to adequate AML regulation and supervision and the parent of the client exercises appropriate oversight over the client) poses less risk from a money laundering perspective than a client that is unregulated or subject only to minimal AML regulation. Additionally, companies and their wholly owned subsidiaries that are publicly owned and traded on a recognized exchange pose minimal money laundering risks. Even though it may become substantially more difficult to distinguish between legitimate and illegitimate transactions, these companies are usually from jurisdictions with an adequate, recognised regulatory scheme, and therefore, generally pose less risk due to the type of business they conduct and the wider governance regime to which they are subject. In addition, the necessity to have a specific understanding of each of the transactions conducted by these companies is mitigated by the nature of the company (publicly owned and traded from jurisdictions with adequate controls). Moreover, these entities may not need to be subjected to as stringent procedures in relation to account opening due diligence or transaction monitoring, during the course of the relationship. The regularity or duration of the relationship. Long standing relationships involving frequent client contact throughout the relationship may present less risk from a money laundering perspective. The familiarity with a jurisdiction, including knowledge of local laws, regulations and rules, as well as the structure and extent of regulatory oversight, as the result of an institution s own operations within the jurisdiction. Greater familiarity will enhance the ability of the institution to assess the client. The use by clients of intermediate corporate vehicles or other structures that have no clear commercial or other rationale or that unnecessarily increase the complexity or otherwise result in a lack of transparency for the financial institution. Such vehicles or structures will increase the risk unless the rationale is understood and the structure is sufficiently transparent to the institution. 5.3 Regulatory risks category This category of risks is associated with not meeting the requirements of the AML Law and relevant Directives. Examples of regulatory obligations that may be breached include: Client verification not done properly e.g. due to lacking of necessary documentation Failure to train staff adequately Not having an AML program Failure to report suspicious matters